← All changes | includes/class-metasync-connect-manager.php +75 -49 2.6.25 → 2.7.2 View file →

		@@ -88,9 +88,9 @@
88	88	$general_options = Metasync::get_option('general') ?? [];
89	89	$plugin_auth_token = $general_options['apikey'] ?? '';
90	90
91	91	if (empty($plugin_auth_token)) {
92		- error_log('MetaSync ERROR: Plugin Auth Token missing from options - should have been generated during activation');
	92	+ error_log('MetaSync ERROR: Plugin Auth Token missing from options - should have been generated during activation'); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- unreachable in production
93	93	return false;
94	94	}
95	95
96	96	return $plugin_auth_token;
		@@ -188,9 +188,9 @@
188	188	wp_send_json_error(array('message' => 'Failed to save new token'));
189	189	}
190	190
191	191	} catch (Exception $e) {
192		- error_log('Plugin Auth Token Refresh Error: ' . $e->getMessage());
	192	+ error_log('Plugin Auth Token Refresh Error: ' . $e->getMessage()); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- genuine failure path, bounded, no secrets
193	193	wp_send_json_error(array('message' => 'Error generating new token'));
194	194	}
195	195	}
196	196
		@@ -222,9 +222,9 @@
222	222	wp_send_json_error(array('message' => 'Plugin Auth Token not found'));
223	223	}
224	224
225	225	} catch (Exception $e) {
226		- error_log('Get Plugin Auth Token Error: ' . $e->getMessage());
	226	+ error_log('Get Plugin Auth Token Error: ' . $e->getMessage()); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- genuine failure path, bounded, no secrets
227	227	wp_send_json_error(array('message' => 'Error retrieving Plugin Auth Token'));
228	228	}
229	229	}
230	230
		@@ -270,15 +270,28 @@
270	270	$domain = str_replace('://www.', '://', get_site_url());
271	271
272	272	$dashboard_domain = Metasync_Admin::get_effective_dashboard_domain();
273	273
274		- $sa_connect_url = $dashboard_domain . '/sso/wordpress?' . http_build_query([
	274	+ $connect_args = [
275	275	'nonce_token' => $sa_connect_token,
276	276	'domain' => $domain,
277	277	'callback_url' => get_rest_url(null, 'metasync/v1/searchatlas/connect/callback'),
278	278	'return_url' => admin_url('admin.php?page=' . Metasync_Admin::$page_slug)
279		- ]);
	279	+ ];
280	280
	281	+ if (Metasync_Headless_Config::is_active()) {
	282	+ $connect_args['frontend_domain'] = Metasync_Headless_Config::get_frontend_domain();
	283	+ }
	284	+
	285	+ $sa_connect_url = $dashboard_domain . '/sso/wordpress?' . http_build_query($connect_args);
	286	+
	287	+ // Consent-gated analytics: the denominator for searchatlas_connected.
	288	+ $existing_key = Metasync::get_searchatlas_api_key();
	289	+ Metasync_PostHog::feature('searchatlas_connect_started', array(
	290	+ 'is_reconnection' => is_string($existing_key) && $existing_key !== '',
	291	+ 'is_whitelabel' => (bool) Metasync::is_whitelabel_enabled(),
	292	+ ));
	293	+
281	294	wp_send_json_success(array(
282	295	'connect_url' => $sa_connect_url,
283	296	'nonce_token' => $sa_connect_token,
284	297	'debug_info' => array(
		@@ -323,9 +336,9 @@
323	336	if (!$this_auth_completed && wp_using_ext_object_cache()) {
324	337	global $wpdb;
325	338
326	339	// Check expiry first
327		- $timeout = $wpdb->get_var(
	340	+ $timeout = $wpdb->get_var( // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- manual transient rows on the options table (autoload=no) — mirrors core transient storage; TTL reads need the paired timeout row
328	341	$wpdb->prepare(
329	342	"SELECT option_value FROM {$wpdb->options} WHERE option_name = %s LIMIT 1",
330	343	'_transient_timeout_' . $success_key
331	344	)
		@@ -332,12 +345,12 @@
332	345	);
333	346
334	347	if ($timeout && (int) $timeout < time()) {
335	348	// Expired — clean up
336		- $wpdb->delete($wpdb->options, array('option_name' => '_transient_' . $success_key));
337		- $wpdb->delete($wpdb->options, array('option_name' => '_transient_timeout_' . $success_key));
	349	+ $wpdb->delete($wpdb->options, array('option_name' => '_transient_' . $success_key)); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- manual transient rows on the options table (autoload=no) — mirrors core transient storage; TTL reads need the paired timeout row
	350	+ $wpdb->delete($wpdb->options, array('option_name' => '_transient_timeout_' . $success_key)); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- manual transient rows on the options table (autoload=no) — mirrors core transient storage; TTL reads need the paired timeout row
338	351	} else {
339		- $db_value = $wpdb->get_var(
	352	+ $db_value = $wpdb->get_var( // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- manual transient rows on the options table (autoload=no) — mirrors core transient storage; TTL reads need the paired timeout row
340	353	$wpdb->prepare(
341	354	"SELECT option_value FROM {$wpdb->options} WHERE option_name = %s LIMIT 1",
342	355	'_transient_' . $success_key
343	356	)
		@@ -353,10 +366,10 @@
353	366	delete_transient($success_key);
354	367	// Also clean up DB fallback rows
355	368	if (wp_using_ext_object_cache()) {
356	369	global $wpdb;
357		- $wpdb->delete($wpdb->options, array('option_name' => '_transient_' . $success_key));
358		- $wpdb->delete($wpdb->options, array('option_name' => '_transient_timeout_' . $success_key));
	370	+ $wpdb->delete($wpdb->options, array('option_name' => '_transient_' . $success_key)); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- manual transient rows on the options table (autoload=no) — mirrors core transient storage; TTL reads need the paired timeout row
	371	+ $wpdb->delete($wpdb->options, array('option_name' => '_transient_timeout_' . $success_key)); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- manual transient rows on the options table (autoload=no) — mirrors core transient storage; TTL reads need the paired timeout row
359	372	}
360	373
361	374	// Get current settings to return connection status
362	375	$general_settings = Metasync::get_option('general') ?? [];
		@@ -453,8 +466,13 @@
453	466	} elseif ($pull['status'] === 'error') {
454	467	// Honest state: surface the real server error (e.g. "Domain not
455	468	// found for customer") instead of the silent 60s timeout. The
456	469	// existing JS branches on status_code (404/500/…) to render it.
	470	+ // Once per connect attempt, even if the poll repeats.
	471	+ Metasync_PostHog::feature_once('searchatlas_connect_failed', array(
	472	+ 'status_code' => $pull_status_code ?: 400,
	473	+ 'source' => 'pull',
	474	+ ), md5($nonce_token), 15 * MINUTE_IN_SECONDS);
457	475	wp_send_json_success(array(
458	476	'updated' => true,
459	477	'status_code' => $pull_status_code ?: 400,
460	478	'message' => isset($connect['message']) ? sanitize_text_field($connect['message']) : '',
		@@ -557,9 +575,9 @@
557	575	$general_options = Metasync::get_option('general') ?? [];
558	576	$plugin_auth_token = $general_options['apikey'] ?? '';
559	577
560	578	if (empty($plugin_auth_token)) {
561		- error_log('MetaSync ERROR: Plugin Auth Token missing from options');
	579	+ error_log('MetaSync ERROR: Plugin Auth Token missing from options'); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- genuine failure path, bounded, no secrets
562	580	return false;
563	581	}
564	582
565	583	$random_bytes = wp_generate_password(32, false, false);
		@@ -597,12 +615,12 @@
597	615	$timeout_active = '_transient_timeout_metasync_sa_connect_active_' . $sa_connect_token;
598	616	$timeout_metadata = '_transient_timeout_' . $transient_key;
599	617	$expires = time() + 900;
600	618
601		- $wpdb->replace($wpdb->options, array('option_name' => $active_option, 'option_value' => $transient_key, 'autoload' => 'no'));
602		- $wpdb->replace($wpdb->options, array('option_name' => $timeout_active, 'option_value' => $expires, 'autoload' => 'no'));
603		- $wpdb->replace($wpdb->options, array('option_name' => $metadata_option, 'option_value' => maybe_serialize($token_metadata), 'autoload' => 'no'));
604		- $wpdb->replace($wpdb->options, array('option_name' => $timeout_metadata, 'option_value' => $expires, 'autoload' => 'no'));
	619	+ $wpdb->replace($wpdb->options, array('option_name' => $active_option, 'option_value' => $transient_key, 'autoload' => 'no')); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- manual transient rows on the options table (autoload=no) — mirrors core transient storage; TTL reads need the paired timeout row
	620	+ $wpdb->replace($wpdb->options, array('option_name' => $timeout_active, 'option_value' => $expires, 'autoload' => 'no')); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- manual transient rows on the options table (autoload=no) — mirrors core transient storage; TTL reads need the paired timeout row
	621	+ $wpdb->replace($wpdb->options, array('option_name' => $metadata_option, 'option_value' => maybe_serialize($token_metadata), 'autoload' => 'no')); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- manual transient rows on the options table (autoload=no) — mirrors core transient storage; TTL reads need the paired timeout row
	622	+ $wpdb->replace($wpdb->options, array('option_name' => $timeout_metadata, 'option_value' => $expires, 'autoload' => 'no')); // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- manual transient rows on the options table (autoload=no) — mirrors core transient storage; TTL reads need the paired timeout row
605	623	}
606	624
607	625	return $sa_connect_token;
608	626	}
		@@ -736,9 +754,9 @@
736	754	{
737	755	global $wpdb;
738	756
739	757	try {
740		- $rate_limit_transients = $wpdb->get_results(
	758	+ $rate_limit_transients = $wpdb->get_results( // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- transient enumeration/cleanup on the options table — no API to scan or bulk-delete transient rows
741	759	"SELECT option_name FROM {$wpdb->options} WHERE option_name LIKE '_transient_sa_connect_rate_limit_%'",
742	760	ARRAY_A
743	761	);
744	762
		@@ -763,9 +781,9 @@
763	781	public function clear_jwt_token_cache()
764	782	{
765	783	global $wpdb;
766	784
767		- $deleted = $wpdb->query(
	785	+ $deleted = $wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- manual transient rows on the options table (autoload=no) — mirrors core transient storage; TTL reads need the paired timeout row
768	786	$wpdb->prepare(
769	787	"DELETE FROM {$wpdb->options} WHERE option_name LIKE %s",
770	788	'_transient_metasync_jwt_token_%'
771	789	)
		@@ -770,9 +788,9 @@
770	788	'_transient_metasync_jwt_token_%'
771	789	)
772	790	);
773	791
774		- $wpdb->query(
	792	+ $wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery -- manual transient rows on the options table (autoload=no) — mirrors core transient storage; TTL reads need the paired timeout row
775	793	$wpdb->prepare(
776	794	"DELETE FROM {$wpdb->options} WHERE option_name LIKE %s",
777	795	'_transient_timeout_metasync_jwt_token_%'
778	796	)
		@@ -896,9 +914,9 @@
896	914	try {
897	915	$response = wp_remote_post($url, $args);
898	916
899	917	if (is_wp_error($response)) {
900		- error_log('MetaSync: JWT token API request failed - ' . $response->get_error_message());
	918	+ error_log('MetaSync: JWT token API request failed - ' . $response->get_error_message()); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- genuine failure path, bounded, no secrets
901	919	return false;
902	920	}
903	921
904	922	$response_code = wp_remote_retrieve_response_code($response);
		@@ -904,9 +922,9 @@
904	922	$response_code = wp_remote_retrieve_response_code($response);
905	923	$response_body = wp_remote_retrieve_body($response);
906	924
907	925	if ($response_code !== 200) {
908		- error_log('MetaSync: JWT token API returned error code ' . $response_code);
	926	+ error_log('MetaSync: JWT token API returned error code ' . $response_code); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- genuine failure path, bounded, no secrets
909	927	return false;
910	928	}
911	929
912	930	$data = json_decode($response_body, true);
		@@ -911,9 +929,9 @@
911	929
912	930	$data = json_decode($response_body, true);
913	931
914	932	if (!$data || !isset($data['token'], $data['expires'])) {
915		- error_log('MetaSync: Invalid JWT token API response format');
	933	+ error_log('MetaSync: Invalid JWT token API response format'); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- genuine failure path, bounded, no secrets
916	934	return false;
917	935	}
918	936
919	937	$token_data = array(
		@@ -927,9 +945,9 @@
927	945
928	946	return $data['token'];
929	947
930	948	} catch (Exception $e) {
931		- error_log('MetaSync: Exception during JWT generation - ' . $e->getMessage());
	949	+ error_log('MetaSync: Exception during JWT generation - ' . $e->getMessage()); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- genuine failure path, bounded, no secrets
932	950	return false;
933	951	}
934	952	}
935	953
		@@ -1070,18 +1088,16 @@
1070	1088
1071	1089	$cleaned_tokens = $this->cleanup_searchatlas_nonce_tokens();
1072	1090	$cleared_data['sa_connect_nonce_tokens'] = 'none (simplified token system)';
1073	1091
1074		- delete_option(Metasync::option_name . '_whitelabel_user');
1075		- $cleared_data['whitelabel_user'] = 'removed';
	1092	+ // White-label identity is preserved across the authentication
	1093	+ // reset: the reseller's branding, logos, domains, custom OTTO
	1094	+ // name, visibility/access controls, password and recovery
	1095	+ // settings, and the dedicated whitelabel_user option must survive
	1096	+ // the disconnect. Only authentication tokens and credentials are
	1097	+ // cleared above. Do not delete the whitelabel blob or the
	1098	+ // whitelabel_user option here.
1076	1099
1077		- if (isset($options['whitelabel'])) {
1078		- $cleared_data['whitelabel_settings'] = 'removed';
1079		- unset($options['whitelabel']);
1080		-
1081		- $this->write_options_without_stored_merge($options);
1082		- }
1083		-
1084	1100	$this->clear_jwt_token_cache();
1085	1101	$this->revoke_mcp_jwt_tokens();
1086	1102	$cleared_data['jwt_token_cache'] = 'cleared';
1087	1103
		@@ -1105,8 +1121,30 @@
1105	1121	$cleared_data['last_known_connection_state'] = 'cleared';
1106	1122
1107	1123	Metasync_Heartbeat_Manager::instance()->unschedule_heartbeat_cron();
1108	1124
	1125	+ // Consent-gated analytics: churn signal, the opposite of connected.
	1126	+ Metasync_PostHog::feature('searchatlas_disconnected', array(
	1127	+ 'method' => 'reset_auth',
	1128	+ 'was_connected' => isset($cleared_data['searchatlas_api_key']),
	1129	+ ));
	1130	+
	1131	+ // Re-synchronise the branded plugin file headers so the WordPress
	1132	+ // plugin list and the plugin UI stay branded after the
	1133	+ // authentication reset. Only attempted when white-label branding
	1134	+ // exists, and a failed sync is logged as a warning, not reported
	1135	+ // as a reset failure: the credentials have already been cleared,
	1136	+ // and hosts with read-only plugin files would otherwise never see
	1137	+ // a successful reset.
	1138	+ if (Metasync::is_whitelabel_enabled()) {
	1139	+ if (!class_exists('Metasync_Activator')) {
	1140	+ require_once plugin_dir_path(dirname(__FILE__)) . 'includes/class-metasync-activator.php';
	1141	+ }
	1142	+ if (!Metasync_Activator::sync_plugin_file_headers()) {
	1143	+ error_log('MetaSync: failed to re-synchronise branded plugin file headers after the authentication reset.');
	1144	+ }
	1145	+ }
	1146	+
1109	1147	wp_send_json_success(array(
1110	1148	'message' => 'Authentication has been reset successfully. You can now connect a new account.',
1111	1149	'cleared_data' => $cleared_data,
1112	1150	'timestamp' => current_time('mysql', true)
		@@ -1112,9 +1150,9 @@
1112	1150	'timestamp' => current_time('mysql', true)
1113	1151	));
1114	1152
1115	1153	} catch (Exception $e) {
1116		- error_log('Authentication Reset Error: ' . $e->getMessage());
	1154	+ error_log('Authentication Reset Error: ' . $e->getMessage()); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- genuine failure path, bounded, no secrets
1117	1155	wp_send_json_error(array(
1118	1156	'message' => 'An error occurred while resetting authentication. Please try again or contact support.',
1119	1157	'code' => 'reset_failed',
1120	1158	'error' => $e->getMessage()
		@@ -1180,20 +1218,8 @@
1180	1218	));
1181	1219	}
1182	1220
1183	1221	/**
1184		- * Simple AJAX test without nonce (for debugging connectivity)
1185		- */
1186		- public function simple_ajax_test()
1187		- {
1188		- wp_send_json_success(array(
1189		- 'message' => 'Basic AJAX connectivity works',
1190		- 'timestamp' => time(),
1191		- 'no_nonce_required' => true
1192		- ));
1193		- }
1194		-
1195		- /**
1196	1222	* Test whitelabel domain configuration (development/debugging)
1197	1223	*/
1198	1224	public function test_whitelabel_domain()
1199	1225	{
		@@ -1241,10 +1267,10 @@
1241	1267	if (!is_admin()) {
1242	1268	return;
1243	1269	}
1244	1270
1245		- $active_tab = isset($_GET['tab']) ? $_GET['tab'] : 'general';
1246		- $current_page = isset($_GET['page']) ? $_GET['page'] : '';
	1271	+ $active_tab = isset($_GET['tab']) ? $_GET['tab'] : 'general'; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only routing, each action verifies its own nonce
	1272	+ $current_page = isset($_GET['page']) ? $_GET['page'] : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only routing, each action verifies its own nonce
1247	1273
1248	1274	$whitelabel_settings = Metasync::get_whitelabel_settings();
1249	1275	$user_password = $whitelabel_settings['settings_password'] ?? '';
1250	1276	$hide_settings_enabled = !empty($whitelabel_settings['hide_settings']);
		@@ -1279,11 +1305,11 @@
1279	1305	if (isset($_POST['whitelabel_logout'])) {
1280	1306	if (wp_verify_nonce($_POST['whitelabel_logout_nonce'] ?? '', 'whitelabel_logout_nonce')) {
1281	1307	$auth->revoke_access();
1282	1308
1283		- $redirect_tab = $_GET['tab'] ?? 'whitelabel';
	1309	+ $redirect_tab = isset($_GET['tab']) ? sanitize_key(wp_unslash($_GET['tab'])) : 'whitelabel';
1284	1310	$redirect_url = admin_url('admin.php?page=' . Metasync_Admin::$page_slug . '&tab=' . $redirect_tab);
1285		- wp_redirect($redirect_url);
	1311	+ wp_safe_redirect($redirect_url);
1286	1312	exit;
1287	1313	}
1288	1314	}
1289	1315